Proton VPN
protonvpn.com · 2 records in Egress and tunnels, IP and proxies · JSON
Records 2
- caveatProton VPN (paid)USD 3.49/month
IP and proxiesfree tieridentity emailno cardevidence documentedstale on 2026-12-04
- paidProton VPN (plus)USD 3.49/month
Egress and tunnelsidentity emailno cardlimit write-gatedevidence documentedstale on 2026-12-05
Proton VPN (paid)
IP and proxies- Free allowance
- Free plan, quoted from the pricing page: Connect to servers in 10 countries (randomly selected) and Secure 1 device at a time.
- Verdict
- caveatusable, with a named limit or an unprobed read path
- Cost
- free tierpaid plans from USD 3.49/month
- Identity
- emailno card, no phone
- Binding limit
- noneno named constraint binds
- Evidence
- documented10 sources; a first-party page was read and the sentence quoted
- Freshness
- stale on 2026-12-04checked 2026-11-03 (live); stale on 2026-12-04
| Free tier | Free plan, quoted from the pricing page: Connect to servers in 10 countries (randomly selected) and Secure 1 device at a time. unit users; metered on identity-count; One device at a time, not one account. The 10 countries are drawn at random, so the free tier does not let a client choose its country. |
|---|---|
| Price | $9.99 per month list; $3.49 per month on a 24-month plan; a subscription price, not a per-TB price |
| Limits |
Three constraints were found that the vocabulary has no kind for: the Free plan allows one device at a time; its server pool is 10 countries selected at random, so the exit cannot be chosen; and /vpn/logicals requires an authenticated session, so the 21,202-server fleet cannot be enumerated without an account. The measured exit sits in a hosting ASN (AS212238), which is why the record stops at rung 4. |
| Binding | none Nothing in the vocabulary fails at 45 GB/month across about 599,000 requests: the vendor states no data limit, no rate was observed to be shaped, and the exit answered a Worker request at HTTP 200. What does bind sits outside the vocabulary — the Free plan's one device at a time, its random 10-country pool, and an authenticated session for /vpn/logicals. The caveat that keeps this off rung 5 is the ASN's class, not a quota. |
| Identity | email An account registered with an email address. The facts record email as the only registration cost and name no second gate; the paid plans are sold against that account. |
| Egress | Proton VPN offers a Free plan with no data limits, no artificial speed limits, and no compromises on your privacy and security; a feature blurb on the same page offers fast download speeds and unlimited bandwidth. The page publishes no byte allowance and no overage price for any plan it lists. free allowance: none published: the vendor states no data limits rather than a volume |
| Per-object cap | not applicable: an exit address, not an object |
| Retention | not applicable: a live tunnel and a rented exit address, not stored bytes |
| Interface | cli, rest The Linux CLI and the authenticated REST API at /vpn/logicals. The desktop and mobile apps and a web UI reach the same servers, and WireGuard and OpenVPN configurations are offered. endpoint: /vpn/logicals — requires an authenticated session: HTTP 400 with Code 5002 Missing x-pm-appversion header when the app-version header is absent, HTTP 422 when it is present and the token is not valid. |
| Tooling | A Cloudflare Worker fetches through the exit with plain HTTP; nothing bespoke is needed and no wrapper exists for exit selection. The CLI and generated WireGuard or OpenVPN configurations reach the same servers, but picking a specific exit needs an authenticated session, because /vpn/logicals refuses unauthenticated reads. |
| Composes with | Secure Core is a hop topology, not a class change: it inserts an entry hop and leaves the exit's registration class where it was. |
| Reliability | One exit was measured once: 149.50.216.236 answered a Cloudflare Worker request at HTTP 200 with a 14-byte body on 2026-10-03, and RIPE still maps the address to AS212238 on 2026-10-24; the fleet could not be enumerated, so nothing is claimed about the other servers' exits. |
| Notes | Proton VPN is the topic's baseline: it is the one non-Cloudflare exit measured working inside a Cloudflare Worker, so every other exit is judged against it. The measurement is a single sample — one exit, one request, HTTP 200, a 14-byte body — and the fleet could not be enumerated, because /vpn/logicals refuses unauthenticated reads. The endpoint answered HTTP 400 with Code 5002 Missing x-pm-appversion header, then HTTP 422 once an app-version header was present and the token was not, which is the same conclusion by a different status. It does not clear rung 5: AS212238 is a hosting ASN, so the exit is a datacenter address and the class question is answered no. RIPE establishes the ASN and its holder (CDNEXT, Datacamp Limited, ORG-DL201-RIPE, GB) and carries no IP-type field, so the hosting classification is read from the holder's identity, one step above the registry; that step is the weakest link in the rung-5 judgement. Secure Core is a hop topology, not a class change: it inserts an entry hop and leaves the exit's registration class exactly where it was, so it cannot be used to reach rung 5. The pricing page states the Free plan has no data limits and no artificial speed limits, and a feature blurb on the same page offers unlimited bandwidth. |
| Evidence note | documented The exit, its prefix and its ASN are measured: a Worker request returned the address and RIPE maps the /24 to AS212238. The price, the free-tier terms and the no-data-limit sentence are vendor-page reads, and the fleet count could not be enumerated, so the weakest rung the verdict rests on is documented. A paid account, a 45 GB transfer through one exit with a byte count at both ends, and an authenticated fleet listing would move the record to measured throughout. |
| Parsed numbers |
|
Evidence 10
| date | source | what it proved |
|---|---|---|
| 2026-10-24 | protonvpn.com/pricing | List price $9.99 per month and $3.49 per month on the 24-month plan; Free plan is 1 device at a time in 10 randomly selected countries with no data limits and no artificial speed limits; the FAQ answer recommends a paid plan with servers in over 140 countries; a feature blurb offers unlimited bandwidth. |
| 2026-10-03 | probe: 149.50.216.236 | A Cloudflare Worker request left through the Proton exit: HTTP 200, 14 bytes, body 149.50.216.236. |
| 2026-10-24 | stat.ripe.net/data/prefix-overview/data.json?resource=149.50 | 149.50.216.0/24 is announced and its announcing AS is 212238, holder CDNEXT Datacamp Limited; related prefix 149.50.0.0/15; query_time 2026-10-24T08:00:00. |
| 2026-10-24 | rest.db.ripe.net/ripe/aut-num/AS212238.json | AS212238 has as-name CDNEXT and org ORG-DL201-RIPE, status ASSIGNED, created 2020-12-02, last-modified 2026-07-14; org ORG-DL201-RIPE is Datacamp Limited, GB. RIPE carries no IP-type field, so the hosting classification is read from the holder, not from a registry class. |
| 2026-10-24 | probe: /vpn/logicals | Unauthenticated /vpn/logicals returns HTTP 400 with Code 5002 Missing x-pm-appversion header, and HTTP 422 once an app-version header is sent without a valid token, so the fleet cannot be enumerated without an account. |
| 2026-11-03 | probe: rdap.db.ripe.net/ip/149.50.216.236 | Registry object NET-149-50-216-0-1 (name CDNEXT-STO-CG, 149.50.216.0-149.50.216.255) covering the Proton exit address 149.50.216.236 is an ASSIGNMENT registered to Datacamp Limited, with parent NET-149-50-208-0-1. |
| 2026-11-03 | probe: rdap.arin.net/registry/ip/149.50.208.0/20 | NET-149-50-208-0-1 (name DATACAMP-CGNT-NET-5, 149.50.208.0-149.50.223.255) is an ALLOCATION, parent NET-149-50-0-0-1. |
| 2026-11-03 | probe: rdap.arin.net/registry/ip/149.50.0.0 | NET-149-50-0-0-1 (name COGENT-149-50-16, 149.50.0.0-149.50.255.255) is a DIRECT ALLOCATION whose registrant is Cogent Communications. |
| 2026-11-03 | probe: rdap.db.ripe.net/autnum/212238 | The registrant organisation ORG-DL201-RIPE of aut-num AS212238 is Datacamp Limited. |
| 2026-11-03 | probe: rdap.db.ripe.net/autnum/212238 | RIPE aut-num AS212238 has as-name CDNEXT. |
More fields 16
| rung | 4 |
|---|---|
| rung note | The exit address, its /24 and its announcing ASN are measured, but the ASN belongs to a hosting provider, so the record stops at ASN and does not reach registration class. |
| exit ip | 149.50.216.236 |
| asn | AS212238 |
| asn name | CDNEXT |
| asn holder | CDNEXT Datacamp Limited |
| asn org | ORG-DL201-RIPE |
| prefix | 149.50.216.0/24 |
| related prefix | 149.50.0.0/15 |
| measured in | Cloudflare Worker |
| measurement at | 2026-10-03T19:09:40Z |
| response bytes | 14 |
| fleet stated | servers in over 140 countries per the pricing page read 2026-10-24 |
| secure core | hop topology, not a class change |
| price usd | {"monthly_list": 9.99,"per_month_on_24": 3.49} |
| registration class | ARIN ASSIGNMENT: the exit's range 149.50.216.0-149.50.216.255 (NET-149-50-216-0-1, CDNEXT-STO-CG) is registered to Datacamp Limited, inside Datacamp Limited's ARIN ALLOCATION 149.50.208.0-149.50.223.255 (NET-149-50-208-0-1, DATACAMP-CGNT-NET-5), inside Cogent Communications' ARIN DIRECT ALLOCATION 149.50.0.0-149.50.255.255 (NET-149-50-0-0-1, COGENT-149-50-16). The registry carries no IP-type field, so the class is the registration chain: a range assigned to a hosting company, not an ISP subscriber block. |
Proton VPN (plus)
Egress and tunnels- Free allowance
- Port forwarding is currently available on our Windows, macOS, and Linux GUI apps for everyone with a paid Proton VPN plan.
- Verdict
- paidno free allowance; listed for its price
- Cost
- USD 3.49/monthparsed from the record, in USD
- Identity
- emailno card, no phone
- Binding limit
- write-gatedNAT-PMP mapping expires in 60 seconds and must be looped: natpmpc -a 1 0 udp 60 -g 10.2.0.1, with sleep 45 between calls; closing the terminal terminates the loop
- Evidence
- documented10 sources; a first-party page was read and the sentence quoted
- Freshness
- stale on 2026-12-05checked 2026-11-04 (live); stale on 2026-12-05
| Free tier | Port forwarding is currently available on our Windows, macOS, and Linux GUI apps for everyone with a paid Proton VPN plan. The plan table marks P2P/BitTorrent as absent from Proton Free and present on VPN Plus. VPN Plus on the 24-month plan: billed at $83.76 for the first 24 months, then renews at $83.88 every 12 months; the 12-month price is unverified: the pricing page rendered here shows only the monthly and 24-month figures. unit none; metered on none |
|---|---|
| Price | USD 83.76 billed for the first 24 months on VPN Plus (USD 3.49 per month), then renewing at USD 83.88 every 12 months |
| Limits | |
| Binding | write-gated At 1 TiB/month nothing in the pages read states a byte cap, so the thing that fails first is the mapping: a 60-second NAT-PMP lease driven by a loop, on a port the vendor says usually changes when you reconnect. That is a keepalive dependency, not a volume limit. |
| Identity | email An account with an email address; the signup page offers Or sign up for free and then a paid plan, with card, PayPal or Google Pay. |
| Egress | unverified: no page read states a Proton VPN traffic allowance for the paid tier; the plan table lists features and speeds, not bytes.; ingress: tcp+udp free allowance: none published |
| Interface | cli Account web page generates configs; port control is NAT-PMP on the tunnel gateway, not a REST API. Protocols: WireGuard over UDP and TCP, OpenVPN, IKEv2, Stealth (obfuscated) and Smart Protocol. No SOCKS5 proxy is offered. P2P servers (BitTorrent) are included on paid plans. |
| Tooling | natpmpc from libnatpmp, or the official app; WireGuard config from the account page. |
| Composes with | Provides the public endpoint; the loop that keeps the lease alive is a small daemon a user must run beside the service. |
| Reliability | The forwarded port expires 60 seconds after the last NAT-PMP renewal; a crashed loop closes the port silently. |
| Notes | The practical consequence is that ingress works but the endpoint is not addressable across a reconnect without a control loop that rewrites the consumer's config. |
| Evidence note | documented Measured would need an account, a natpmpc loop and a byte count. The moving-port sentence comes from the GUI guide, so the stability claim is documented and the byte ceiling is openly unverified. |
| Parsed numbers |
|
Evidence 10
| date | source | what it proved |
|---|---|---|
| 2026-10-23 | protonvpn.com/support/port-forwarding | Port forwarding is on all paid plans and not on Free; The port number usually changes when you reconnect to VPN. |
| 2026-10-23 | protonvpn.com/support/port-forwarding-manual-setup | A WireGuard config can carry NAT-PMP port forwarding; mappings last 60 seconds and must be renewed in a loop; example allocation port 53186 for both UDP and TCP. |
| 2026-10-23 | protonvpn.com/pricing | Proton Free has no P2P/BitTorrent and connects to servers in 10 countries; VPN Plus carries P2P. |
| 2026-10-23 | account.protonvpn.com/signup?plan=vpn2024¤cy=EUR | VPN Plus prices: 9.99 EUR per month monthly, 5.32 EUR per month billed at 63.81 EUR for 12 months, 4.49 EUR per month billed at 107.76 EUR for 24 months. |
| 2026-11-04 | protonvpn.com/pricing | the VPN Plus 24-month plan is billed $83.76 and renews at $83.88 every 12 months |
| 2026-11-04 | protonvpn.com/support/how-to-change-vpn-protocols | Stealth and Smart Protocol are Proton protocols alongside WireGuard, OpenVPN and IKEv2 |
| 2026-11-04 | protonvpn.com/support/how-to-change-vpn-protocols | WireGuard is offered over TCP as well as UDP |
| 2026-11-04 | protonvpn.com/support/socks5 | Proton VPN does not offer a SOCKS5 proxy |
| 2026-11-04 | protonvpn.com/support/bittorrent-vpn | P2P servers are on all paid plans |
| 2026-11-04 | protonvpn.com/pricing | VPN Plus 24-month plan is billed 83.76 USD, then renews at 83.88 USD every 12 months |
More fields 6
| wg path | native-conf |
|---|---|
| wg detail | A WireGuard configuration file is generated in the account with the port-forwarding toggle baked in: Select a VPN server that supports P2P (double-arrow icon) and generate a WireGuard configuration file. When doing this, ensure that Select VPN options then NAT-PMP (port forwarding) is enabled. Mappings are then made with natpmpc from a user. |
| ingress | tcp+udp |
| volume stated | unverified: no page read states a Proton VPN traffic allowance for the paid tier; the plan table lists features and speeds, not bytes. |
| bytes transit | yes |
| transit note | Traffic exits at the P2P server's address for the duration of the mapping. |
Unknown values 2
- per object cap stated: the field does not apply to this kind of offer
- retention stated: the field does not apply to this kind of offer